The Financial Services Commission is revising the calculation standards for fines under the Credit Information Act, which have raised concerns that 'bombshell-level fines' could be imposed disproportionate to the severity of violations. The commission plans to reform the current system, which applies a minimum fine rate of 50% based on 3% of total sales revenue even for minor violations, so that fines are levied in proportion to the nature of the violation.
On the morning of the 16th, the Financial Services Commission held a task force (TF) meeting chaired by Yu Yeong-jun, Digital Finance Policy Officer, with representatives from the Financial Supervisory Service and financial associations in attendance. (See Money Today's September 14 exclusive report: 'Shock over 'trillion-won' new credit information law fines... 12 financial firms on edge')
The Credit Information Act was amended in February 2020, raising the maximum fine from 3% of relevant sales revenue to 3% of total sales revenue. The scope of violations subject to fines was also expanded from leakage and unauthorized disclosure of personal credit information to improper provision and use, as well as mishandling of pseudonymized information.
The problem lies in the fact that when calculating the fine amount, the current inspection and sanction regulations applied across all financial sectors are used directly without separate criteria under the Credit Information Act to define violations.
Currently, the inspection and sanction regulations apply uniformly across all financial sectors, evaluating severity based on general factors such as motive and method of violation. In contrast, the Personal Information Protection Act (PIPA) and the European Union's General Data Protection Regulation (GDPR) utilize various elements reflecting the specific characteristics of personal information protection—such as the type of personal data, number of affected individuals, and impact of harm—in determining severity.
The financial authorities determined that the current three-tier fine rate system alone makes it difficult to calculate fines proportional to specific violations. Under the existing system, a base fine is calculated by applying fine rates of 50%, 75%, or 100% to the statutory maximum of 3% of total sales revenue, depending on the severity of the violation. Even if a violation is assessed at the lowest level, the base fine is set at half of the statutory maximum.
The Personal Information Protection Act and the EU's GDPR employ more granular criteria. PIPA applies fine rates ranging from 1% to 30% for minor violations, while GDPR applies rates between 0% and 10% for low-level infringements. The Financial Consumer Protection Act also established separate fine calculation standards in November last year, mandating a rate of 1% to 30% for minor violations.
Additionally, the Credit Information Act, following its 2020 amendment, calculates fines based on total sales revenue, including portions not directly related to the violation. In contrast, laws such as the Banking Act and the Insurance Business Act base fines on amounts directly tied to the violation. For example, exceeding a bank's credit extension limit is calculated based on the excess credit amount, while an insurance company's failure to fulfill disclosure obligations is calculated based on the premium income from the relevant insurance contract.
Recently, the Financial Supervisory Service decided to impose a 140 billion won fine on Dongyang Life Insurance for violating the new Credit Information Act, but the Financial Services Commission significantly reduced it to 7 billion won—a case that occurred precisely due to flaws in the current fine imposition system.
The financial authorities plan to establish separate fine calculation standards reflecting the unique characteristics of the Credit Information Act and proceed with related regulatory revisions. They also discussed incorporating measures where financial institutions proactively prevent personal credit information breaches or actively work to restore consumer damages into the process of increasing or reducing fines.
in FINANCE
